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^ " Abstract 

e. 

The quantum Fourier transform (QFT) is sometimes said to be the source of various 
exponential quantum speed-ups. In this paper we introduce a class of quantum circuits 
which cannot outperform classical computers even though the QFT constitutes an es- 
scntial component. More precisely, we consider normalizer circuits. A normalizer circuit 
over a finite Abelian group is any quantum circuit comprising the QFT over the group, 
gates which compute automorphisms and gates which realize quadratic functions on the 
group. We prove that all normalizer circuits have polynomial-time classical simulations. 
The proof uses algorithms for linear diophantine equation solving and the monomial ma- 
trix formalism introduced in our earlier work. We subsequently discuss several aspects 
of normalizer circuits. First we show that our result generalizes the Gottesman-Knill 
Ql theorem. Furthermore we highlight connections to Shor's factoring algorithm and to 

the Abelian hidden subgroup problem in general. Finally we prove that quantum fac- 
toring cannot be realized as a normalizer circuit owing to its modular exponentiation 
■ subroutine. 

00 ■ 1 Introduction 

; 

The quantum Fourier transform (QFT) is arguably the most important operation in the 
field of quantum algorithms. Indeed this transform is a principal component in several 
quintessential algorithms (cf. [H [2] for reviews), most importantly Shor's factoring algo- 
rithm [3j. In fact it is sometimes said that the QFT is the crucial non-classical ingredient 
accounting for the (believed) speed-up of quantum factoring. 

Whereas in quantum algorithm design the focus lies on identifying scenarios where usage 
of the QFT yields new quantum speed-ups, in this paper a complementary question is asked: 
under which conditions does a quantum algorithm, in spite of its use of the QFT, fail to 
outperform classical computation? Insight in this problem may shed light on the QFT's 
function in quantum computation and indicate avenues for new quantum algorithms. In 
addition, since quantum algorithms have provided new ways to relate Fourier transforms to 
various problems in e.g. number theory and group theory (the central example being the 
factoring problem) a deeper understanding of the QFT might also lead to better classical 
algorithms for these problems. 

Whereas colloquially one often refers to "the" QFT as if it were a single operation, a 
different QFT is in fact associated with every finite group. The standard QFT is denned 
over the Abelian group of integers modulo 2™. Throughout this work we focus on QFTs 
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over arbitrary finite Abelian groups. This is arguably the class of QFTs which has been 
most successfully employed in quantum algorithms [2]. 

We will introduce a class of quantum circuits, called here normalizer circuits. A normal- 
izer circuit over an Abelian group G is any circuit containing the QFT over G and two other 
types of operations, called automorphism gates and quadratic phase gates, both of which 
have natural group-theoretic definitions. In our main result we prove that all polynomial- 
size normalizer circuits, acting on a natural class of inputs (called coset states) and followed 
by a standard basis measurement, can be simulated classically in polynomial time. 

This result sharply contrasts with the QFT's reputation of being classically intractable. 
In particular it highlights (complementary to previous works, cf. below) that the believed 
speed-up of e.g. Shor's algorithm cannot straightforwardly be attributed to the mere pres- 
ence of the QFT: a more subtle mechanism must be responsible for this. We will go into 
some detail analyzing the relation between normalizer circuits and quantum factoring. In 
particular we will prove that Shor's algorithm cannot be realized by a normalizer circuit, 
showing that (non-surprisingly) our result does not yield an efficient classical factoring al- 
gorithm. The single component of Shor's algorithm that is not covered by the normalizer 
gates formalism is modular exponentiation, which is sometimes (mistakenly, in our opinion) 
considered to be a simple "classical" step. In spite of this no-go result, we will highlight 
close connections between normalizer circuits and quantum factoring, and the Abelian hid- 
den subgroup problem (HSP) in generaQ- Interestingly, the quantum states occurring in the 
HSP algorithm and those generated by normalizer circuits turn out to be very similar and, 
all in all, we find it very difficult to give a concise intuitive reason that clarifies why normal- 
izer circuits have efficient classical simulations whereas the factoring algorithm (probably) 
does not. In particular the usual superficial arguments that the power of quantum factoring 
comes from entanglement, interference or other "quantumness" measures, seem to apply 
equally well to normalizer circuits. Probably this indicates that such arguments have little 
merit and that much more delicate considerations are necessary. 

Finally we remark that our results generalize the celebrated Gottesman-Knill theorem 
which regards classical simulations of Clifford circuits [6]. In the language of the present 
work, Clifford circuits correspond to normalizer circuits over the group Z2 x ... x Z2. 

Relation to previous work. To our knowledge, classical simulations of QFTs were previ- 
ously investigated in three independent works; these results are similar to one another but 
different from ours. In Ref. [7] it was shown that the approximate QFT over Z2™ acting 
on a product input state and followed immediately by measurement in a product basis can 
be simulated classically in quasi-polynomial 0(n logn ) time. In Ref. [8] the same scenario 
was considered and a fully efficient classical simulation was achieved; more generally, effi- 
cient simulations were obtained for constant-depth circuits of bounded interaction range, 
interspersed with a constant number of approximate QFTs. In Ref. |9j efficient simulations 
were obtained for the "semi-classical" QFT acting on a class of entangled input states. The 
common ingredient in these works is their use of tensor contraction schemes which depend 
crucially on the structure of the quantum circuit. These methods are only efficient when the 
graph representing the topology of the circuit is sufficiently close to a tree graph as measured 
by the tree- width [TT| . A common feature of such circuits is that they can only generate lim- 
ited amounts of entanglement (of certain type) [12]. The fundamental distinction with the 

1 Recall that the HSP encompasses the factoring problem as a special instance [HE]. 
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present work is that our classical simulations are independent of the structure of the circuit. 
This comes at the cost of restricting the allowed operations, similar to the Gottesman-Knill 
theorem. Finally we mention that in [TO] it was shown that the existence of an efficient clas- 
sical algorithm to simulate the modular exponentiation circuit acting on arbitrary product 
input states and for arbitrary product measurement, would imply an efficient simulation of 
Shor's algorithm. This result is similar in spirit to our result that modular exponentiation 
is the only component of quantum factoring that cannot be realized by a normalizer circuit. 

Organization of this paper. Readers who are mainly interested in the results rather than 
their proofs may focus on sections [2]|5] where we introduce normalizer circuits, describe our 
main result and discuss its relation to Shor's algorithm and the HSP. In subsequent sections 
mathematical tools are developed and proofs of our main results are given. Considerable 
effort goes into laying out the necessary group theoretic concepts and their computational 
complexity, cf. section [6] In section [7] we discuss generalized Pauli and Clifford operators 
over Abelian groups. In section [8] we recall recently introduced techniques to describe and 
classically simulate a class of many body-states called M-states [24] • In section [9] we prove 
our main classical simulation result by combining the methods developed in sections [6]j8l 
In section [10] we prove that Shor's factoring algorithm cannot be realized as a normalizer 
circuit. Finally in section [11] we give more examples of normalizer circuits. 

2 Normalizer circuits 

Throughout this paper the symbol G will represent a finite Abelian group given as a direct 
product of cyclic groups: 

G = Z dl x - - - x Z dm (1) 

where denotes the additive group of integers modulo dj. It is a fundamental result that 
every finite Abelian group is isomorphic to a decomposition of this form. Here we assume 
that G is presented explicitly in this way; this is a nontrivial constraint since computing this 
decomposition is generally a hard task. Every group element is a tuple g = g\ ■ ■ ■ g m where 
gi G Zrf 4 . Addition of group elements is performed componentwise where arithmetic in the 
i-th component is modulo d%. The cardinality of G is denoted by q. For every i we introduce 
a Hilbert space Hi with orthonormal basis {\x) : x G Z^.}. Taking the tensor product of 
these m spaces we obtain a g-dimensional space %. Defining \g) := \g±) ■ ■ ■ ® \g m ), the 
space % has a tensor product basis where each basis vector is labeled by an element of G. 
This basis will be called the standard basis. Note that the above construction of the space 
% is commonly used in the field of quantum algorithms (cf. e.g. \2\). We now define three 
classes of unitary operators on %. 

Quantum Fourier transforms. The quantum Fourier transform (QFT) over Z^ is the 
following unitary operator on T~Li'. 

Fi = -j=^uf* y \x){y\-, cut = exp{2iri/di) (2) 
V "4 

where the sum is over all x,y G Z^. . The QFT over the entire group G is given by F = 
i*i <8> • • • <8> F m . Any operator obtained by replacing a subset of operators Fi in this tensor 
product by identity operators will be called a partial QFT. 
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Automorphism gates. An automorphism a is an isomorphism from G to itself. The as- 
sociated automorphism gate U a maps \g) — > \a(g)). Since every automorphism is invertible, 
U a is a unitary operator which acts a permutation on the standard basis. 

Quadratic phase gates. A function B from G x G to the nonzero complex numbers is 
said to be bilinear if for every g,h,x £ G one has 



A function £ from G to the nonzero complex numbers is said to be quadratic if there exists 
a bilinear function B such that for every g,h £ G one has 



Given a quadratic function £, the quadratic phase gate is the diagonal operator mapping 
\d) ~* £(sOls)- I n section T6.3I we will show that £(g) is a complex phase for every g £ G. 
This implies that every quadratic phase gate is a unitary operator. 

A unitary operator which is either a (partial) quantum Fourier transform or its inverse, 
an automorphism gate or a quadratic phase gate will generally be referred to as a normalizer 
gate; the origin of this nomenclature will be clarified in section [7J A quantum circuit 
composed entirely of normalizer gates is called a normalizer circuit over G. The size of a 
normalizer circuit is the number of normalizer gates of which it consists. 

We further recall how computational cost is measured in the present context. A (classical 
or quantum) computation is called efficient if the number of elementary operations of which 
it consists scales polynomially in the logarithm of g. Since g coincides with the dimension 
of H, the above definition is compatible with the standard concept of efficiency in quantum 
computation viz. the number of operations scales polynomially with the logarithm of the 
Hilbert space dimension. In this work we will subsequently consider families of normalizer 
circuits of size polylog(g), henceforth called polynomial size normalizer circuits. 

It is not evident that each individual normalizer gate can itself be efficiently realized on a 
quantum computer i.e. as a quantum circuit composed of polylog(g) elementary gates. It is 
well known that (partial) quantum Fourier transforms over arbitrary finite Abelian groups 
can be realized as efficient quantum circuits, either approximately [13] or exactly |14j . In 
appendix [A] we show that all automorphism gates and quadratic phase gates can also be 
realized exactly as efficient quantum circuits. 

3 Examples 

We illustrate the definitions of normalizer gates with two examples viz. and Z2™. Both 
groups have g = 2 m so the notion "efficient" is synonymous to "in poly(m) time" . See also 
section [IT] for further examples of normalizer gates. 

3.1 Z™ and Clifford circuits 

The group Z™ consists of all m-bit strings with addition modulo 2. Each Hilbert space Hi 
is a single qubit with basis {|0), |1)} so the total Hilbert space H is a system of m qubits. 
The standard basis is the usual computational basis. Applying definition ([2]) one finds that 
the QFT over Z2 is simply the Hadamard gate H. The QFT over Z™ is the m-fold tensor 



B(g + h,x) = B(g,x)B(h,x) and B(x, g + h) = B(x, g)B(x,h). 



(3) 



Z(9 + h)=Z(9)Z(.h)B(g,h). 



(4) 
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product of H with itself and a partial QFT acts as H on some subset of the qubits and 
as the identity elsewhere. An automorphism of Z™ is a linear map x — > Ax where A is an 
invertible m x m matrix over Z2. An example is the CNOT operation between any two 
bits. An example of a quadratic function for m = 1 is the function x — ¥ i x where x E Z2. 
To verify that @ holds, one uses that i x+v = i x i y (—l) xy for every x,y G Z2, where x + y 
denotes the sum modulo 2. For m = 2 the function (x,y) — > (— 1)^ is quadratic as well, as 
can be easily verified. The quadratic phase gates corresponding to the above functions are 
the single-qubit ^-phase gate and the two-qubit controlled-Z gate, respectively: 

D= diag(l,i); CZ = diag(l, 1,1,-1). (5) 

For arbitrary m, the gate D acting on any single qubit and CZ acting on any pair of 
qubits are quadratic phase gates as well. We can thus conclude that every quantum circuit 
composed of CNOT, H, CZ and D gates is a normalizer circuit over Z™. We thus recover 
the well known class of Clifford circuits. 

3.2 Z 2m and "the" QFT 

Consider the group Z2™ consisting of integers modulo 2 n . The space T~L is 2 n -dimensional 
and the standard basis is labeled by the integers from to 2 n — 1. The difference with Z™ is 
that the structure of Z2™ does not naturally induce a factorization of H into m single-qubit 
systems, since the decomposition (UJ) only contains a single cyclic group. As a consequence 
we will see that normalizer gates over Z 2 ™ will act globally on T~L, in contrast with Z™ where 
we found that certain normalizer gates are single- and two-qubit gates. 

The QFT over Z 2 ™ is the commonly known transform occurring in e.g. Shor's factoring 
algorithm. An explicit formula is obtained by replacing di by 2 m in ([2]). There are no partial 
QFTs since the decomposition (pQ) contains a single cyclic group. Consider an arbitrary 
a G Z2"i which is coprime to 2 m . Then the multiplication map x — > ax is an automorphism; 
the coprimality condition ensures that this map is invertible |15| . Hence |x) — > \ax) defines 
an automorphism gate. In section [11] we show that 

D = J2 co bx2+cx \x)(x\ and E = £ j bx( - x+2m ^\x)(x\; oj = e 2 W 2m , 7 = uj 1 / 2 (6) 

are quadratic phase gates for arbitrary b, c G Z 2 ™ . In the definition of E, the quantity 
bx{x + 2 m ) is computed over the integers. 

4 Main result 

In our main result (theorem Q] below) we show that all polynomial size normalizer circuits 
can be efficiently simulated classically. Before stating this result we make some notions more 
precise. 

Generally speaking, in the context of classical simulations the task is the following: given 
the description of a quantum circuit, its input and measurement, reproduce the output of 
the computation in polynomial time on a classical computer. In the standard quantum 
circuit paradigm comprising local gates acting on at most d qubits for some constant d, 
each gate can be naturally described by specifying on which d-qubit subsystem it acts and 
by listing all 2 d x 2 d matrix elements; the description of the entire circuit is then essentially 
the concatenation of all descriptions of the gates in the circuit. In the context of normalizer 
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circuits, however, the situation is different since these gates may act globally on the entire 
0-dimensional Hilbert space (cf. the example of Z2™ above). Therefore, specifying such 
operators in terms of their gx q matrix elements is in general exponentially inefficient and a 
different encoding should be used. In fact it is a priori not obvious that an efficient encoding, 
i.e. comprising polylog(g) bits, exists at all for arbitrary normalizer gates. Next we show 
that this is the case. 

First, a partial quantum Fourier transform is simply described by the set of systems Hi 
on which it acts nontrivially. 

Second we consider automorphism gates. For every i ranging from 1 to m, denote by 
e l £ G the group element which has 1 6 in its i-th component and zeroes elsewhere, 
where in slot k represents the neutral element in Z^ . Remark that g = Yl 9i e * f° r ever y 
g £ G so that the m elements e 1 generate G. Therefore every automorphism a is fully 
specified by the m x m matrix 



We call A the matrix representation of a. Note that each column contains an element 
of G and can thus be described by O(^logdj) = O(logg) bits. Furthermore for every 
decomposition ([T]) one has m = O(logjj) so that A has O(logg) columns [25]. Therefore, A 
yields an efficient description of U a . 

Third, letting £ be an arbitrary quadratic function, in section 16.31 we will show that 

Ql. £ is completely determined by its action on the elements e % and e % + e?\ 

Q2. i(g) 2 % = 1 for every g € G. Thus there exist n(g) £ Z 2g such that £(g) = e nin( - 9 ^ s . 

It follows that the 0(m 2 ) integers n(e l ) and n(e* + e J ) comprise an efficient description of 
£ and thus of the associated quadratic phase gate. 

Henceforth we will assume that all normalizer gates are specified in terms of the descrip- 
tions given above, which will be called their standard encodings. The standard encoding of a 
normalizer circuit consists of the concatenation of the standard encodings of the normalizer 
gates of which it is made up. 

Finally, we will consider the following family of input states. If K is a subgroup of G 
and x £ G, the associated coset state is 



where the sum is over all k 6 K. The standard encoding of this coset state is given by a 
generating set of K of size polylog(g) (henceforth called a polynomial size generating set) 
together with the element x. This description is efficient. Remark that in particular every 
standard basis state is a coset state. 

Theorem 1 (Classical simulations of normalizer circuits). Let G = x • • x Z^ m 

be a finite Abelian group. Consider a polynomial size normalizer circuit over G acting on 
a coset input state, where both circuit and input are specified in terms of their standard 
encodings as described above. The circuit is followed by a measurement in the standard 
basis. Then there exists an efficient classical algorithm to sample the corresponding output 
distribution. 

Theorem [1] generalizes a well known result in the theory of classical simulations viz. the 
Gottesman-Knill theorem [6]. The latter regards classical simulations of Clifford circuits. 




(7) 




(8) 
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The connection between normalizer circuits and Clifford circuits is obtained by considering 
the group Z™ as in section 13.11 Theorem [JJ thus shows that every polynomial-size Clifford 
circuit acting on a coset input state and followed by a computational basis measurement, can 
be simulated efficiently classically. This recovers (a variant of) the Gottesman-Knill theorem. 
Analogously, considering Z™ where d is any constant, theorem [JJ recovers previously known 
generalizations of the Gottesman-Knill theorem from qubits to d- level systems |18|. [19] . 

The novel content of theorem [1] regards all groups which cannot be decomposed as a 
direct product Z™ with d constant. An interesting case is the single cyclic group Z2™ as 
in section 13.21 Theorem [JJ implies that every quantum circuit composed of poly(m) QFTs 
over Z2™, multiplication gates \x) — > \ax) and diagonal gates D and E, when acting on a 
coset input state and followed by standard basis measurement, can be simulated classically 
in poly(m) time. More generally, one may also consider e.g. an n-fold direct product Z^ 
and construct the corresponding normalizer circuits. In this case "efficient" is synonymous 
to "in poly(n,m) time". Theorem [JJ implies that polynomial size normalizer circuits over 
this group can be efficiently simulated classically. We refer to section [11] for more examples 
of normalizer gates. 

Finally we point out two additional features of our results. First, theorem [JJ will yield 
an efficient algorithm to sample the output distribution II of any normalizer circuit with 
perfect accuracy. Second, we will fully characterize II as follows: There exists x G G and a 
subgroup HOG such that IT is the uniform distribution over the coset H + x. Furthermore 
x and a generating set of H can be computed efficiently. 

5 Relation to Shor's factoring algorithm and the HSP 

We revisit Shor's factoring algorithm |3] in light of theorem [JJ Recall that this algorithm 
employs two quantum registers. Register 1 is a 2 m -dimensional Hilbert space with standard 
basis states \x) with x £ Z2™. Register 2 is A-dimensional with basis states \y) with 
y G Zjv where N is the number one wishes to factor. Fixing also o G Zjv coprime to N, 
Shor's algorithm consists of the following steps [31 [2| [TH] . 

51. Initialize the total system in the state |0, 0). 

52. Apply the QFT over Z2™ to register 1. 

53. Apply the unitary operator U me defined by \x,y) — > \x,y + a x ). 

54. Apply the QFT over Z2™ to register 1. 

55. Measure register 1 in the standard basis. 

Repeating the above procedure T times for some suitable T scaling polynomially with the 
input size log A and suitably postprocessing the collected measurement outcomes with a 
classical computer yields a factor of N in polynomial time, as proved by Shor. We now 
consider the class of normalizer circuits over G = Z2™ x Z^v and ask whether S1-S5 are 
accounted for by theorem [JJ Except modular exponentiation S3, all steps are obviously 
covered. In section [3JJ we prove that U me cannot be well-approximated by any normalizer 
circuit: 

Theorem 2. Let N = pq where p > 2 and q > 2 are prime withp 7^ q, let a 6 Zjv be coprime 
to N and consider m > 2. Consider the unitary operator U me defined in S3. There does 
not exist any (even exponential-size) normalizer circuit C satisfying \\C — U me \\ < 1 — 2 -1 / 2 
where \\ ■ \\ denotes the operator norm. 
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Therefore theorem [T] does not lead to an efficient classical simulation of Shor's algorithm. 
But what is now "the" crucial element accounting for the speed-up of this algorithm? Is it 
the QFT — after all the only other component in the algorithm is modular exponentiation, 
which is a "classical" operation as it can entirely realized by e.g. a circuit of Toffoli gates? 
Or is it modular exponentiation — after all this is the only component not covered by the 
formalism of normalizer circuits? The point is that such questions do not have absolute 
answers as they are only meaningful in a relative setting: relative to the class of Toffoli 
circuits, the QFT is the essential ingredient that gives the factoring algorithm its power. 
By the same token, relative to the class of normalizer circuits, the essential ingredient is 
precisely modular exponentiation. The power of quantum factoring lies precisely it its 
ingenious combination of both elements. 

We provide further connections between normalizer circuits and quantum factoring. 
Broadening our scope, we treat the hidden subgroup problem (HSP) for arbitrary Abelian 
groups [4j [2j [16]. In the HSP one has oracle access to a function / : G — > Zn for some 
Abelian group G and for some N, where it is promised that there exists an (unknown) sub- 
group HOG such that f(g) = f(h) iff g — h G H. The goal is to compute a generating set 
of H. Whereas the best classical algorithm requires 0(q) operations, there exists a quantum 
algorithm which solves the problem in polylog(cj) time. Very similar to Shor's algorithm, 
the HSP algorithm uses two registers. Register 1 is g-dimensional with standard basis states 
\g) where g £ G, and register 2 is iV-dimensional with basis states \y) with y £ Z^v- Letting 
F denote the QFT over G, the steps in the HSP algorithm are fully analogous to S1-S5 as 
follows: initialize in |0,0); apply F to register 1; apply Uf : \g,y) — »■ \g, y + f(g)); apply F 
to register 1; measure register 1. 

Similar to Shor's algorithm, the quantum circuit for the HSP is not realized by any 
normalizer circuit because of Uf. However, let us consider the state p of register 1 after 
application of Uf. It is well known (and easily verified) that p is the uniform mixture of all 
coset states of H: 



Now remark that the only remaining operation in the HSP algorithm is the QFT, which is a 
normalizer gate. Revisiting theorem [1] we find that a computation with input p followed by 
the application of the QFT can be simulated efficiently classically (by generating a random 
x G G and by classically simulating the QFT acting on the input \H + x)). This appears 
to imply that the quantum algorithm for the HSP can be simulated efficiently classically by 
virtue of theorem [TJ However this conclusion is incorrect: the crucial point is that in the 
HSP the state p is unknown as H is unknown — indeed the entire purpose of the HSP is to 
identify H ! Therefore theorem [T] cannot be applied in this setting. 

In short, the HSP can be embedded in the same computational model considered in 
theorem [H which has normalizer circuits acting on (mixtures of) coset state(s) as its main 
ingredients. The crucial distinction is that in the HSP the input state p is unknown and 
the goal is to identify it, as in a tomography problem. This viewpoint also highlights the 
important role of the first stage of the HSP algorithm whose purpose is the preparation 
of the unknown p via application of Uf - even though this first stage appears to be a 
mere "classical" step! Another implication is that we cannot expect to learn much about 
the speed-up achieved by the HSP algorithm (and thus in particular Shor's algorithm) by 
quantifying, say, how much entanglement is generated during the subroutine p — > FpF^ . 




x&G 
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Indeed the exact same process with a fully known but otherwise identical input state p can 
be simulated classically. 

6 Preliminaries on Abelian groups 

Here we discuss concepts in group theory such as characters, endomorphisms and quadratic 
functions, as well as the computational complexity of some group theoretic tasks. 

6.1 Characters and orthogonal groups 

We review some basic representation theory of finite Abelian groups; see [T7] for more details. 
The set J- of all complex functions / : G — > C is well known to be a g-dimensional Hilbert 
space where the inner product between two functions f± and fi is defined by (/i,/2) : = 
/i (5O/2 (9)', here the sum is over all g G G and f\(g) is the complex conjugate of fi(g). A 
character of G is a function x G J 7 satisfying x(<?) 7^ f° r every g and 

X(g + h) = x(g)x{h) for every g,h £ G. (10) 

Equivalently, a character is a homomorphism from G to the multiplicative group of nonzero 
complex numbers. The trivial character maps g — > 1 for every g. For every g = g\ ■ ■ ■ g m , 
define the following complex function on G: 

Xg-h = hi---h m -> exp2vri(^ + --- + ^) . (11) 

Lemma 1 (Characters). For all g,h G G and for all characters x an d V' ^ e following 
holds: 

(a) If x 7^ ip then (x,^) = i.e. these characters are orthogonal. 

(b) Xg is 0, character of G. 

(c) Xg{h) = Xh(g)- 

(d) Xg+h = XgXh- 

(e) Define S(g) := J2heGXg{h). Then 5(0) = and S(g) = for every g^Q. 

(f) Every character is a quadratic function. 

(g) The QFT over G satisfies F = ^2 Xg(h)\g)(h\, where the sum is over all g,h G G. 

(h) Every character of G is one of the functions Xg i- e - G has precisely q characters. 

Proof: since x 1S a homomorphism one has x(0) = 1- Since gg = for every g G G and 
since % ls a character it follows that 1 = x(0) = x(Q9) = x(g) 9 - This shows that x{d) is 
a complex phase for every g G G. If x is different from ip there exists go G G such that 
x(go) 4>(9o) and thus, since x(fi'o) is a complex phase, x(go)tl>(go) / 1. Then 

(x,^) = ^2x(g)^{g) = ^x(g + go)Hg + 9o) 

= x(go)iP(go) X] x(g)ip(g) = x(go)4>{go)(x,4>) (12) 

where sums are over all g G G, and claim (a) follows. Claims (b)-(c)-(d) follow straightfor- 
wardly from definition (llip . To prove (e) note that S(g) coincides with the inner product 
between the character Xg an d the trivial character. Furthermore Xg is the trivial character 
iff g = 0. Using (a) then yields (e). To prove (f) remark that ((4|) is satisfied by taking B to 
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be the trivial bilinear function which sends all (g,h) to 1. Claim (g) is obtained straight- 
forwardly by using the definitions of Xg anci F- Let J- denote the g-dimensional space of all 
complex functions on G as above. Since every two characters are orthogonal owing to (a), 
there can be at most q characters. Owing to (b) all functions Xg are characters; furthermore 
Xg = Xh iff 9 = h so that there are precisely q distinct functions Xg- It follows that there 
can be no other characters; this proves (h). □ 

For every subgroup HOG define the following subset of G: 

:= {g G G : x g (h) = 1 for every h G H}. (13) 

Lemma 2 (Orthogonal groups). For every subgroup HOG the following holds. 

(a) H 1 - is a subgroup of G, called the orthogonal group of H. 

(b) li^l • \H\=Q. 

(c) (H^ = H. 

Proof: (a) is proved straightforwardly by using that each Xg 1S a character. To prove 
(b), for every g G G let tp g : H — > C be the restriction of Xg to H i.e. ip g (h) = Xg(h) for 
every h G H. The function ifj g is easily seen to be a character of H. Define 

r{g) := Xg(h) = £ %{h). (14) 
heH heH 

Remark that r(g) is the inner product between the trivial character of H and the character 
ip g . Lemma U implies that r(g) = \H\ if tj) g is the trivial character on H and r(g) = 
otherwise. Furthermore the definition of H 1 - implies that ip g is the trivial character precisely 
when g G H^. Thus r(g) = \H\ iff g G H^. Now consider the state \H) as in (JSj) - Then 
(recalling lemma [Tg) 

W = -7=m E E X,W\g) = -±= E r(g)\g) = ^3 £». (15) 

Since F is unitary, the norm of F\H) is 1. Together with (|15p this yields (b). Finally we 
prove (c). By definition one has g G H-^ 1 - iff Xg(k) = 1 for all k G H^~. Consider h G H. 
Then by definition of H 1 - one has Xk(h) = 1 for all k G H 1 - . Using lemma [It it follows 
that h G H^ 1 - and we conclude that H C H . Applying claim (b) to H and H 1 - yields 
IHWHM =q = IHMIH- 1 - 1 -] so that \H\ = IH^I. But then we must have H = H ±J ~. □ 



6.2 Endomorphisms 

An endomorphism w of G is a homomorphism from G to itself i.e. w{g + h) = w{g) + w{h) 
for all g,h G G. Every endomorphism w has an m x m matrix representation similar to ([7]). 
We characterize which matrices can occur a matrix representations of endomorphisms. 

Lemma 3 (Matrix representation). Let A be an m x m matrix where the entries in the 
k-th row of A belong to T^d k for every k. Let a 1 G G denote the i-th column of A. Then 
there exists an endomorphism of G with matrix representation A if and only if dia 1 = for 
every i. 
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Proof: let A be the matrix representation of an endomorphism w. Since die 1 = 0, it 
follows that = w{0) = w{d,ie % ) = diVj{e L ) and so did 1 = 0. We prove the converse. 
Consider a matrix A satisfying did 1 = for every i. Define w{g) := Yli9i al f° r every 
9 = 9i • • • 9m £ G. We prove that w is an endomorphism. Consider arbitrary g,h £ G. We 
introduce the following notation: the sum of gi and hi over Z^. is denoted by gi © hi. The 
sum of these two numbers regarded as integers is denoted by gi + hi. With this notation, 
applying the definition of vj one obtains 

w{g + h) = ^2( gi © hi)d . (16) 
w(g) + m(h) = ^gjd + ^h t d = ^{g i + h i )a i . (17) 

Since the i-th component of g + h is gi © hi = gi + hi mod di, there exists an integer qi 
such that gi ® hi = gi + hi + qidi. Since e^a 4 = 0, it follows that {gi + hi)d = {gi © /ij)a\ 
Combining this last equation with (I16p and (I17p shows that w is an endomorphism. □ 



Consider an endomorphism w, fix g £ G arbitrarily and consider the map = x 9 • ro: 

ip g : x <E G ^ Xg{ w { x ))- (18) 

Using that Xg is a character and that is an endomorphism one shows that ip g is also a 
character. Recalling lemma [Th there must hence exists a unique g such that ip g = Xg- Let 
w denote the map which sends g to g. Using lemma [TJi it is straightforward to show that 
w is also an endomorphism. Indeed for every x £ G one has 

Vg+h{x) = Xg+h{™{x)) = Xg{™{x))Xh{™{x)) = ^g{x)fh{x) (19) 

implying that tp g +h = Pg^h and thus w{g + h) = w{g) + -uj{h) for every g,h £ G. The map 
w is henceforth called here the dual endomorphism of w. 

Lemma 4 (Dual matrix representation). Let A be the matrix representation of an 
endomorphism w. Then the matrix representation B of w is given by 

^A lk mod d k = B k i for every k,l = 1,... ,m. (20) 
di 

Proof: we have Xe l { w { ek )) = X-A(e l )( ek ) f° r every k,l by definition of w. Using that A 
and B are the matrix representations of w and w, respectively, this yields 

exp^ = exp^. (21) 

It follows that B k i is equal to d k A[ k /di up to addition of an integer multiple of d k . This 
implies that 

d k Ai k /di mod d k = B kt mod d k . (22) 

Since B is the matrix representation of an endomorphism, B k \ is an integer between and 
d k — 1. This implies that B k i mod d k = B k \ and the result follows. □ 

To illustrate the above result, consider a group G of the form i.e. all cyclic groups 
in the decomposition of G have the same order. Then lemma S] implies that the matrix 
representation of the dual endomorphism is simply the transposed matrix A T . Finally, we 
remark that lemma H] can be used to show that (ro)"= w. The argument is straightforward. 
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6.3 Quadratic functions 

We prove claims Q1-Q2 made in section U] by means of the following lemma. 

Lemma 5 (Quadratic and bilinear functions), (a) A function B from G x G to the 
nonzero complex numbers is bilinear if and only if there exists an endomorphism wofG such 
that B(g,h) = Xm(g){h)- Furthermore for every bilinear function B and quadratic function 
£ as in for every g,h £ G and for every positive integer n, the following holds: 

(b) B(g,0) = l = B(0,g). 

(c) B{g,hy = l. 

(d) c(0) = 1. 

(e) £{ng) = £(g) n B(g,g)f^ where f(n) = n(n - l)/2. 
(!) t{9?* = I- 

Proof: consider an endomorphism w. Using lemma [Tb,d and the fact that vj is an 
endomorphism, one shows that B(g,h) = is bilinear. Conversely, consider an 

arbitrary bilinear function B. By definition of bilinearity, for every fixed g the function 

: h — > B(g, h) is a character. Lemma [TJi implies that there exists a unique g* such that 
f3 g = Xg*- Let w denote the map which sends g to g*. Using that g — > B(g,h) is also 
a character and lemma [T]i it follows that w must be an endomorphism. This proves (a). 
Claim (b) follows from (a) and the fact that tu(0) = for every endomorphism. Claim (c) 
is proved by using (a) and by noting that Xx(y) s = 1 for every x,y G G where the latter 
follows directly from definition (jlip . Using that -B(0, 0) = 1 one finds 

e(0) = £(0 + 0) = £(0)£(0)B(0, 0) = £(0) 2 . (23) 

Recalling in addition that by definition £(g) ^ for every g yields (d). Claim (e) is proved 
by induction on n; the statement is obviously correct for n = 0,1. Assuming (e) holds for 
some integer n, one has 

a(n + 1) 5 ) = i{ng)a 9 )B{ng, g) = €(ng)t(g)B(g, g) n = i{g) n+1 B(g, g)^ +n (24) 

In the first identity we used that £ is quadratic, in the second that B is bilinear; in the final 
identity we used the induction hypothesis. Noting that f{n) + n = f{n + l) yields the proof. 
Using (e) with n = 2g and recalling (c) yields £(2gg) = £(g) 20 . Noting that 2gg = and 
recalling (d) proves (f). □ 

Lemma [5f proves that £(g) is a complex phase. Repeatedly applying the definitions of 
quadratic and bilinear functions yields, for every g = 9i el e G: 

i i<j 



B(e\e J ) = £{e l + e J ) £(e*) (26) 
Furthermore, lemma [5b implies 

£(g ie *) = f (e^WBfe*, e i ) /(9!) - (27) 

We conclude that £(<?) is fully determined by the values £(e l ) and £(e* + e 3 ). 

If £ is a quadratic function where the associated B is given as in lemmaO^, we will simply 
say that £ is a quadratic function with endomorphism w. For every quadratic function, the 
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associated B and w are unique. Uniqueness of B follows from To show uniqueness of 
w, assume that B(g,h) = Xtp(g)(h) for some other endomorphism ip. Then 

1 = B (0, h) = B(g -g,h) = B(g, h)B(-g, h) = X^ {g )(h) X -^ g ){h) = X m (j,)- V (g)(h), (28) 

for all g,h £ G. This implies that w = ip. 

6.4 Computations in Abelian groups 

We show that several problems involving the concepts introduced earlier in this section have 
efficient classical algorithms. In the following the size of an integer is the number of bits in 
its binary expansion. Recall that for every group (pQ) one has m = O(logg). Remark also 
that the size of each di is 0(log g) since di < g and thus for every g = g\ ■ ■ ■ g m G G the size 
of each gi is O(logg) as well. 

We start by discussing some elementary tasks. Given two integers a and b of size at most 
I, their sum, product as well as the remainder a mod b can be computed in poly(Z) time. 
Hence the sum g + h can be computed in polylog(g) time for every g, h G G by computing 
the m remainders gi + hi mod di. Similarly, ng can be computed in polylog(g,n) time for 
every integer n by computing the remainders ngi mod di. 

Let w be an endomorphism given in terms of its matrix representation. Remarking 
that zu(g) = ^2giw(e l ) for every g = g\- ■ • g m , the group element w(g) can be computed 
efficiently on input of g. Lemma U] shows that the matrix representation of w can be 
computed efficiently as well. 

Let £ be a quadratic function given in terms of its standard encoding. Consider the 
associated B as in (J4]) and w as in lemma [5^. Then the matrix representation A of w can 
be computed efficiently: one first computes the quantities B(e k ,e l ) using (f26|) . Using 

B(e k ,e l ) = X ^)(e l ) = e 2 * iA ^ d ' (29) 

yields the matrix element A^. Furthermore the function value can be computed effi- 
ciently on input of g: first compute all quantities B(e l ,e J ) using (i26j) . then compute i{g%e l ) 
using (p7|) . finally compute using (f25|) . 
Next we discuss more involved tasks:. 

Theorem 3 (Efficient computations in Abelian groups). Consider a finite Abelian 
group (TTJ). Then the following problems can be solved in polylog(g) time: 

(a) Given a generating set of a subgroup H, compute a generating set of H . 

(b) Given h , . . . ,h r G G with r = polylog(g) and s\, . . . , s r G Z g , determine whether 
there exists g G G satisfying 

Xhk (g) = e 2 ^ fc / for all k (30) 

and, if yes, compute such a solution g. 

(c) Given the matrix representation of an automorphism a, compute the matrix 
representation of a^ 1 . 

Property (a) is known in the quantum algorithms community, cf. the Abelian HSP algorithm 
[5]. Property (b) is similar to (a). It is however not clear to the author if (c) is known. A 
proof of theorem [3] is given in appendix [Bj For now we mention that a central ingredient in 
the proof is the fact that systems of linear diophantine equations can be solved efficiently, 
as recalled next. 
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Theorem 4 (Linear Diophantine equations [201 EH E2J E3] ) • Let A be annxm matrix 
and let b be an n- dimensional vector, both with integer entries of size at most k. Both A and 
b are specified by listing all of their entries in binary. Then there exists an algorithm with 
running time poly(n, m, k) which decides whether the equation Ax = b has an integer solution 
x. Furthermore, if a solution exist, then there exist integer vectors x° and x 1 , . . . ,x r , for 
some r < m, such that: 

(a) Ax° = b. 

(b) Ax 1 = for all i = 1, . . . , r. 

(c) Every integer solution to Ax = b has the form x = x° + y where y is an integer 
linear combination of the x l . 

Furthermore all components of x° and the x % have size poly{n,m,fc) and can be computed in 
poly(n, m, k) time. 

7 Pauli and Clifford operators over Abelian groups 

Here we consider the Hilbert space H associated with G as in section [2] and define several 
families of operators acting on this space. 

For every g S G define the pair of operators 

X(g) = J2\h + 9)(h\; Z(g) = Y J X g {h)\h){h\ (31) 

where the sums are over all h £ G. Remark that X(g) is a permutation matrix and that 
Z{g) is a diagonal unitary operator. Let a G Z2 9 and consider the following 2g-th root of 
unity 7 := e l7T ^ s . An operator of the form a = j a Z(g)X(h) will be called a Pauli operator 
over G, or Pauli operator in short, as this definition generalizes the standard notion of Pauli 
matrices defined on qubit systems [26]. The triple (a,g,h) is called the label of a. It is 
important that the label constitutes a description of a comprising O(logg) bits i.e. this 
description is efficient. The following commutation relations are verified straightforwardly 
by applying ([31]) : 

X(g)X(h) = X(g + h) = X(h)X(g), 
Z{g)Z{h) = Z(g + h) = Z(h)Z(g), 

Z(g)X(h) = Xg (h)X(h)Z{g). (32) 

The first equation in (|32p implies that the set {X(g) : g £ G} is a group w.r.t. the standard 
operator product. In fact, this group is isomorphic to G: the isomorphism is the map 
g — > X(g). Similarly, {Z(g) : g £ G} is a group isomorphic to G. 

Elementary manipulations with Pauli operators are computationally efficient in the fol- 
lowing sense: 

Lemma 6 (Products and powers of Pauli operators). Consider Pauli operators a and 
t and a positive integer n. Then ar, a n and are also Pauli operators, the labels of which 
can be computed in polylog(Q,n) time on input of n and the labels of a and r. Moreover, 
at = a 2 0- 1 . 

Proof: let (a,g,h) and (b,x,y) denote the labels of a and r, respectively. Using the 
commutation relations (|32p one finds 

<JT = 1 a+h ■Xh(x)-X(g + x)Z(h + y). (33) 
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The overall phase on the r.h.s. of (|33|) has the form 7 s for some s S Z2 g , so that err is indeed 
a Pauli operator. It is straightforward that s as well as g + x and h + y can be computed 
efficiently. The other claims in the lemma are proved analogously. □ 

Lemma [U] implies that the set of all Pauli operators forms a finite group, called here the 
Pauli group (over G). A unitary operator U on T~L is called a Clifford operator (over G) if 
U maps the Pauli group onto itself under the conjugation map a — > UaU^. It is easy to see 
that the set of all Clifford operators forms a group. Formally speaking, the Clifford group 
is the normalizer of the Pauli group in the full unitary group acting on T~L. We now show 
that normalizer gates and Clifford operators are fundamentally interrelated. 

Theorem 5 (Normalizer gates are Clifford). Every normalizer gate is a Clifford op- 
erator. Furthermore let U be a normalizer gate specified in terms of its standard classical 
encoding as in section and let a be a Pauli operator specified in terms of its label. Then 
the label of UaU^ can be computed in polylogfy) time. 

Proof: we show that UX(g)U^ and UZ(g)U^ are Pauli operators with efficiently com- 
putable labels for every g. The proof of the theorem then follows from the fact that every 
Pauli operator is given as a product r y a X(g)Z{h) and by using lemma [6[ 

Let F be the QFT over G, consider an automorphism a and a quadratic function £ 
with endomorphism w. We describe the action of F, U a and on X(g) and Z(g) under 
conjugation; a~* is shorthand for (a -1 )*: 

F : X(g)^Z(g); Z(g) X(-g) 

U a : X(g) X(a(g)); Z(g) -+ Z( a -*(g)) (34) 

: X(g) -> i{g)X{g)Z{w{g))- Z{g) -> Z(g) 

We prove that these are the correct actions. One has 

FX(g)F^\h) = ^Y J ^Xk +a m) = - n zZ^)/Zxk(l-h)\l) (35) 
k,l 1 k 

= lzZx 9 (l)zZxi-h(k)\l)=X 9 (h)\h)=Z(g)\h). (36) 
1 k 

The first identity is obtained using lemma[Tg; using Xk(h) = Xk(—h) and lemmafTJa, d yields 
the second identity; the third identity uses lemma [lb; the fourth is proved using lemma [Tfe. 
The action of the Fourier transform on Z{g) is computed analogously and the argument is 
omitted. 

Using that £/<£ = U a -i yields 

U a X(g)Ut\h) = \a(a-\h) + g)) = \h + a{g)) =X{a(g))\h). (37) 

The action on Z(g) is computed analogously by applying the definition of the dual auto- 
morphism. Finally, one has 

U 6 X(g)Ul\h) = ag + h)W)\9 + h)=ti(g)B(g,h)\g + h) (38) 
= Z(g)Xv,( 9 )(h)\g + h)=Z(g)X(g)Z(zv(g))\h), (39) 

where we in the second identity we have used (j3]) and in the third lemma [5b,. 
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We now show that the actions of normalizer gates on Pauli operators can be computed 
efficiently. The argument heavily relies on theorem [3] as well as the discussion above it. The 
action of F can obviously be computed efficiently. As for U a , recall that the action g — > a(g) 
can be computed efficiently. As the matrix representations of inverse and dual automor- 
phisms can be computed efficiently, the action g — > a~*(g) can be computed efficiently as 
well. As for D^, recall that both £(g) and w{g) can be computed efficiently on input of g 
together with the standard representation of £. 

Finally, analogous to the arguments above, it can be shown that the action of partial 
QFTs can be computed efficiently as well; this argument is omitted. □ 

Variants of the above result were previously known for groups of the form Z™ with d con- 
stant (see |181 [T9] and references within) , although those works do not use the terminology 
of normalizer gates, automorphism gates, quadratic phase gates, etc. 

We conclude by remarking that every Pauli operator can be realized as a polynomial size 
(in fact: constant size) normalizer circuit, up to a global phase. To see this, first note that 
Z{g) is a quadratic phase gate since the functions Xg are quadratic functions (recall lemma 
QJ). As for X(g), recall from (|34p that X(g) = F^Z(g)F. But then every Pauli operator is 
realized as a constant-size normalizer circuit as well. 

8 M-states 

Next we recall results of [24J where a formalism was introduced to describe and classically 
simulate a class of quantum states called M-states. The brief account given here is self- 
contained and will suffice for our purposes. 

As before we let G be an Abelian group with associated Hilbert space %. A unitary 
operator U on H is monomial if U = PD for some diagonal matrix D and some permutation 
matrix P, both relative to the standard basis. A state is an M- state if there exists a group 
Q consisting entirely of monomial unitary matrices such that \ip) is the unique eigenvector 
with eigenvalue 1 of all elements of Q simultaneously. The group Q is said to be a monomial 
stabilizer group of \tp). In theorem [6] below we characterize the structure of an M-state \tp) 
in terms of the properties of Q. To do so we first develop some further concepts. Consider 
U G G and g G G\ then, since U is monomial, there exists h G G such that U\g) oc \h). The 
group thus Q naturally acts on the elements of G via the map g —> h. The orbit of g under 
this action is the set of all h that can be reached by applying all possible elements from Q: 

O g = {h:3U eg s.t. U\g) oc \h)}. (40) 

Finally, for every g G G let Q g be the subset of Q consisting of all U G G satisfying U\g) oc \g) 
i.e. U acts trivially on g; this subset is easily seen to be a subgroup of Q. 

Theorem 6 (M-states [24j). Let \ip) be an M-state with monomial stabilizer group Q. Then 
the following holds: 

(a) is a uniform superposition. This means that all non-zero amplitudes {g\ip) are 
equal in modulus. 

(b) Let S C G be the support of i.e. S is the collection of all g with (g\ip) ^ 0. 
Then S coincides with one of the orbits O x . 

(c) Consider an arbitrary x G G and let V± , . . . , V r be generators of Q x . Then one has 

S = O x iff Vi\x) = \x) for all i. (41) 
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For completeness, theorem is proved in appendix O The relevance of this result for the 
proof of theorem Q] is the following. We will show that the output state \ip) of any normalizer 
circuit is always an M-state. Owing to theorem [6^,-b, a standard basis measurement on 
yields a uniformly random element of O x . We will thus prove theorem Q] by showing that the 
orbit O x can be determined efficiently (using theorem [6b) and, subsequently, that a random 
element in O x can be generated classically efficiently as well. 

9 Proof of theorem [I] 

Consider a polynomial size normalizer circuit C acting on the input \K + x). Note that 
\K + x) = X{x)\K). Since X(x) can be realized as a constant-size normalizer circuit (recall 
section [7]), this operator may be absorbed into C. Thus henceforth in this section we consider 
inputs of the form \K), without loss of generality. 

9.1 The input state 

We start by characterizing the input state as a joint eigenvector of a family of Pauli operators. 
We say that a state is a "+1 common eigenvector" of a set S of operators if the state is 
an eigenvector with eigenvalue 1 for every operator in the set; is the "unique +1 common 
eigenvector" of S if it is, up to a global phase, the only vector with this feature. 

Lemma 7. The set Go consisting of all operators Z(u)X(v) with u G K 1 - and v G K is an 
Abelian group. Furthermore \K) is the unique +1 common eigenvector of Qq. 

Proof: using the definitions of Pauli operators and their commutation relations it is 
easily verified that Gq is an Abelian group and that \K) is a +1 common eigenvector of Qq. 
To show uniqueness, let \ip) be an arbitrary +1 common eigenvector of Go, so that 

{g\Z{u)X{v)\ij}) = (g\i/>) for every u G K 1 , v G K, g G G. (42) 

Using (|3ip this implies that 

Xu(g)(9 + v\^) = (g\rP). (43) 

For every g ^ K there exists u G K 1 - such that Xu{o) 7^ 1: indeed, if this were not the case 
then g would belong to recalling that K = K (see lemma [2b) then contradicts with 

the assumption that g ^ K. It then follows from ([43 p with v = that {g\ip) = for every 
g ^ K. Further, taking u = = g and v G K arbitrary in (I43p implies that {v\ip) = (0|t/>). 
This shows that must be proportional to \K). □ 

9.2 The output state is an M-state 

Lemma [7] implies that the final state C\K) =: \tp) is the unique +1 common eigenvector 
of the group Q obtained by applying the conjugation map A — > CAC^ to all elements of 
Qq. Theorem [5] shows that every element of Q is a Pauli operator. Remark that every Pauli 
operator a is monomial and unitary as it is given as the product of a diagonal unitary matrix 
r y a Z{g) and a permutation matrix (and hence unitary) X(h). Thus is an M-state with 
monomial stabilizer group Q. 
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Theorem [U] implies that is a uniform superposition and that the support of is 
one of the orbits O x as in (|40p . Next we characterize these orbits. If a is a Pauli operator 
with label (a,g,h), we call g the "Z-component" and h the "X-component" of a. Denote 
the X-component formally by (p(cr) := h. Now let H C G be the image of Q under the map 
<p i.e. H is the set of all X-components of the elements of Q. The commutation relations 
p?]) readily yield 

(P(ctt) = (p{(j) + <p(t) for all a,r £ Q. (44) 

This implies that H is a subgroup of G. Using that o~\x) oc \x + h) for every <r G £/ with 
label (0,5, h), one straightforwardly shows that 

O x = x + H (45) 

for every x £ G. Thus these orbits are precisely the cosets of the subgroup H. Theorem 
[6^,-b now immediately implies: 

Corollary 1. There exists x° G G s.t. \tp) is a uniform superposition with support H + 

Let II denote the probability distribution resulting from measuring in the standard basis. 
We have arrived at a crucial insight for the classical simulation we aim to achieve: 

Corollary 2. II is the uniform distribution over the coset H + x°. 



9.3 Computing a generating set of H 

Next we show that a generating set of H can be computed efficiently. Let {u 1 , . . . ,u k } 
generate K with k = O(logg). This set is assumed to be specified as an input. Owing to 
theorem [3^,, a generating set {u k+l , . . . ,u n } of K 1 - can be computed efficiently, for some 
n = O(logg). It follows that Qq is generated by the operators 

X(u 1 ),...,X(u k ),Z(u k+1 ),...,Z(u n ). (46) 

Consequently, a generating set of Q is obtained by conjugating these operators with C: 

( CX(w*)Ct for every i = 1, . . . , k , . 

% ' \ CZ{u l )C^ for every i = k + 1, . . . , n. 

The o~i mutually commute since they are obtained by simultaneously conjugating a set of 
mutually commuting operators. Theorem [5] shows that every o~i is a Pauli operator with 
efficiently computable label, say (ai,g l ,h l ). Remark that (f4"4"J) implies that ip : Q — > G is 
a group homomorphism. Since Q is generated by the o"j and since <p is a homomorphism, 
the image of (p is generated by the elements tp(cri) = h % . But this image is precisely the 
subgroup H . 

9.4 Computing x° 

Next we show that a suitable x° as in corollary Q] can be computed efficiently. Our approach 
will be to use theorem [6b- To this end we first characterize the subgroups Q x C Q which will 
turn out to have a particularly simple form; in particular we will show that all these groups 
are equal. Define the set T> to consist of all a G Q that, up to some global phase, have the 
form Z{g) for some g G G. It is easily verified that this set is a subgroup of G, called the 
diagonal subgroup. 
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Lemma 8. Every group Q x is equal to the diagonal subgroup D. 

Proof: since every D G T> is a diagonal operator, one has D\x) oc showing that 
D Q Qx- Conversely, if a G Q x has label (a, g, h) then a\x) oc \x + h). Since a G Q x the state 
| a;) is an eigenvector of a; this can only be true if h = 0, showing that a £ T>. □ 

Lemma 9. The labels of a generating set ofT> can be computed efficiently. 

Proof: since the o~i mutually commute, the map 

T : k = ki ■ ■ ■ k n £ Z n -> c^ 1 . . . <r^ n G (48) 

satisfies T(fc + A/) = T(k)T(k'). This shows that T is a group homomorphism from the 
additive group Z n to Q. Consider the inverse image of T> under T: 

D = {k G Z n : r(fc) G 2?}. (49) 

Since T is a homomorphism, D is a subgroup of Z n . Furthermore we have T{D) = D: the 
inclusion C holds by definition of D; to show 5, note that the <7j generate so that every 
element in Q can be written as T{k) for some k; therefore every element in T> can be written 
as T(k) with k G D. Our strategy to obtain a generating set of T> will be to first compute a 
generating set of D. Since T(D) = T>, the images of these generators under T will generate 
V. 

Applying ([32]) one finds 

T{k) oc z (J2 hg 1 ) x (J2 hhf) . (50) 

It follows that k G D if and only if ^ kih 1 = 0. This last identity is satisfied iff 

k\hj + • • • + k n hJj = mod dj for every j = 1, . . . , m (where h l = h\ . . . h % m ). (51) 

This in turn holds iff there exists an integer vector I = l\ ■ ■ ■ l m such that 

kih) H h k n hj + djlj = for every j. (52) 

Remark that (|52[) is a system of m linear diophantine equations in the n + m unknowns 
(k,l). Furthermore n = O(logg) = m and hj and dj are integers of size O(logg). Using 
theorem [U a generating set of solutions 

(k a ,l a ), o = l,...,r for some r = polylog(g) (53) 

can thus be computed in polylog(g) time. But then every solution k to (I5ip is generated by 
the elements k a , implying that the latter form a generating set of D. 

As argued above, it now follows that V is generated by the operators T(k a ). Finally, 
given k a the label of T(k a ) can be computed efficiently by repeatedly applying lemma [6l 
since T(k a ) is defined as a product of powers of the Pauli matrices o~{. □ 

We use shorthand notation T(k a ) =: V a for the generators of T> computed in lemma EB 
Since V a belongs to the diagonal subgroup, its label is (c a ,z a ,0) for some c a G Z2 and 
z a G G, all of which are efficiently computable owing to lemma 

In summary so far, we have computed a generating set of T> and thus (via lemma [8]) of 
every subroup Q x . Now let S denote the support of and consider an arbitrary x G G. 
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Theorem [Ut then implies that S = x + H if and only if V a \x) = \x) for every a. This last 
condition holds iff 

Xz a (,%) = 7~ Ca for every a = 1, . . . , r (54) 
where we have used that 

V a \x) = 7 c °Z(z a )\x) = ^ X z^x)\x). (55) 

The equations (|54p are guaranteed to be satisfied by some x since we know from corollary [1] 
that the support S coincides with some coset x + H. Since the l.h.s. of (f54"|) are g-th roots 
of unity, these equations can only have a solution if 7 _Ca is also a g-th root of unity. Thus 
there must exist s a G Z g such that ^~ Ca = e 2ms a/s_ Given c a , the number s a can easily be 
computed. In conclusion, we find that 

S = x + H iff xz<* (x) = e 2wiSa/s for every a = 1, . . . , r. (56) 

Theorem [3b can now be used to compute a solution x = x° efficiently. 

9.5 Sampling from H + x° 

Having determined the coset H + x° coinciding with the support of we show that a 
random element in this coset can be generated efficiently. Recalling corollary [2] this will 
complete the proof of theorem [TJ 

Lemma 10. A random element of H + x° is generated in polylog(g) time as follows: 

(a) Generate ti £ Z uniformly at random, where i = 1, ... ,n. 

(b) Compute h := ^Uh 1 

(c) Output h + x°. 

Proof: first we show that the procedure (a)-(b) generates a uniformly random element 
of H. Remark that this procedure can only output elements within H and, since H is 
generated by the h l , each element of this subgroup occurs with nonzero probability. We 
show that all these probabilities are equal; some care is required since the generators h % are 
not guaranteed to be independent. The map v : — )■ H defined by u(t) := Y2Uh l (where 
t = t\ . . . t n ) is easily seen to be a homomorphism between the additive group Zg and H. 
With (a)-(b) every h E H is generated with probability 

p(h) = \{t:v(t) = h}\/g n . (57) 

The kernel N of v is a subgroup of Z™ since v is a homomorphism. Let th G Z™ be a single 
vector satisfying v(th) = h and consider the coset th + N. We now claim that 

t h + N = {t:v{t) = h}. (58) 

The inclusion C holds trivially. To prove the converse inclusion, note that every t satisfying 
v(t) = h can be written as t = th + 1 — th, where t — th G N. This shows (|58|) . Note further 
that each coset of N has the same cardinality as N. Therefore p(h) is equal to |iV|/|g n | and 
thus independent of h. This shows that this probability distribution is uniform over H. It 
easily follows that (a)-(b)-(c) generates a uniformly random element in H + x°. Finally, it 
is easily verified that this procedure can be implemented efficiently. □ 
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10 Proof of theorem [2] 



Suppose that there exists a normalizer circuit C satisfying \\C — U mc \\ < 5 with 5 = 1 — l/y/2. 
Our goal is to arrive at a contradiction. 

Defining F(x,y) := (x,y + a x ), the inequality \\C — U me \\ < 5 implies that ||C|x,y) — 
\F(x, y)) || < 5 and thus 



\(F(x,y)\C\x,y)\>l-5 = l/V2 (59) 

for every x and y. Since C\x, y) is a coset state, owing corollary [1] this state must be a uniform 
superposition. If this state is a uniform superposition of two or more standard basis states, 
then | (it, v|C|a;, y)\ < l/y/2 for all standard basis states \u,v), yielding a contradiction with 
([59]) . We therefore conclude that C\x,y) is a just a single basis state. In particular ([59]) 
implies that C\x,y) must then coincide with \F(x,y)) for every x and y and thus C = U me . 
We now use the following lemma, to be proved at the end of this section: 

Lemma 11. Consider an arbitrary finite Abelian group G. Consider a unitary gate U : 
\g) —> \F(g)}, where F is a permutation of G, which can be realized as a normalizer circuit. 
Then there exists an automorphism a and t£G such that F{g) = a{g) + 1 and F is called 
affine. 

Since we have showed that C = U mc , lemma QT] implies that the exponential function 
F{x, y) = (x, y + a x ) must be an affine function on the group G = 7^2 m x Zjy. We show that 
this is not the case, implying that our initial assumption about the existence of C was false. 
Suppose that there exists an automorphism a of G with matrix representation A and t G G 
such that F(x, y) = a(x, y) + 1. By evaluating this identity in (0, 0), (1, 0) and (0, 1) is easy 
to show that then t = (0, 1) and 



A 



1 
a- 1 1 



(60) 



The identity F(x, y) = a(x, y) + 1 then implies that 

a x = {a - l)x + 1 mod N for all x E {0, . . . , 2 m — 1}. (61) 

Considering x = 2 yields (a — l) 2 = mod N. Thus, since a / 1, there exists a nonzero 
integer k such that (a — l) 2 = kN. Since N = pq with p ^ q it follows that both p and q 
divide (a — l) 2 . But then p and q also divide a — 1. In other words, both p and q occur 
in the prime decomposition of a — 1. It follows that N = pq divides a — 1. This leads to a 
contradiction since a < N. This proves theorem [2j 



We conclude by proving lemma [TTT Suppose that U can be realized as a normalizer 
circuit. Then for every g G G there exists a(g) G G such that UX(g)U^ = X(a(g)). Indeed 
since U acts as a permutation on the standard basis and since X(g) is also a permutation, 
UX(g)U^ is again a permutation; since by assumption U maps X(g) onto a Pauli operator 
and since only the Pauli operators X(h) are permutations, the claim follows. Using that 

UX(g)rf UX{g')tf = UX(g + g')U^ (62) 
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one shows that a is an automorphism. Applying both sides of the identity UX{g)U^ = 
X(a(g)) to |0) yields 

F(g + F _1 (0)) = a(g) for every g (63) 

Setting h:= g + F _1 (0) and t := -a(F -1 (0)) and using that a is an automorphism yields 
F(h) = a(h) + t for every h G G. This proves lemma [TT1 

11 Further examples of normalizer gates 

In this final section we give further illustrations of group automorphisms and quadratic 
functions, and the associated normalizer gates. See also section [2j 

We first consider automorphisms. Consider an arbitrary a E Z d . Then the multiplication 
map M a : x — > ax is an endomorphism of the cyclic group Z d . If a is coprime to d then a 
has a multiplicative inverse i.e. there exists b in Z d such that ab = 1 |15j . Therefore, for 
such a the multiplication map is an automorphism. Second, consider the group Z dl x Z d2 , 
fix c 6 Z^ 2 satisfying c?ic = mod cfo and define [27] : 

F c : (x, y) e Z dl x Z d2 -> (x, y + xc). (64) 

Owing to lemma EJ the map -F c is an endomorphism. Furthermore this map has an inverse 
viz. F-c, showing that F c is an automorphism. Remark that for d\ = d,2 = 2 and c = 1 one 
obtains the CNOT gate. Considering an arbitrary Abelian group ([l]), applying M a to any 
cyclic group Z d . (with a coprime to d{) and applying F c to any pair Z d . x Z dj (with d, L c = 
mod dj) yield automorphisms of G. Finally, since the set of all automorphisms of any group 
is a group as well, further examples can be obtained by taking products and inverses (and 
combinations thereof) of the examples given above. 

Next we give examples of quadratic functions. Consider a £ Z d . One can straightfor- 
wardly verify that the functions 

xeZ d e 2 * iax/d and x e Z d ^ e ^ 2 /d (65) 

are quadratic functions for Z d . Remark that (|65p coincides with the character Xa- Second, 
consider Z dl x Z d2 and c S Z d2 satisfying d\c = mod di- Then 

(x,y)eZ dl xZ d2 -> e 2 "^/* (66) 

is quadratic. This can be shown by using the following lemma: 

Lemma 12. Consider an arbitrary finite Abelian group. For every endomorphism w, the 
following function is quadratic: fvj(g) := Xg( w (9))- 

Proof: the proof is obtained straightforwardly by using basic properties of Xg an d the 
fact that w is an endomorphism. □ 

Using lemma [3] one notes that w : (x,y) — > (0, cx) is an endomorphism. The associated 
function / ro is precisely (|66p . showing that the latter is indeed quadratic. Remark that 
for d% = d% = 2 and c = 1 the function (|66p maps the pair of bits (x,y) to (— l) xy . The 
associated quadratic phase gate is the CZ gate, cf. section [2 Lemma [T2l allows to generate 
an entire class of quadratic functions. Interestingly, not every quadratic function is of the 
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form f m . To see this, consider again a single cyclic group and denote q a (x) := ax(x + d) 
where a,x 6 but q a (x) is computed is over the integers (i.e. not within Z<j). Then 

x -»• e™*. (*)/<* (67) 

is a quadratic as well; the proof is straightforward but somewhat tedious and we refer to 
appendix [Dj For d = 2 and a = 1 one simply has x — > (— i) x which gives rise to the single- 
qubit phase gate diag(l, —i) as discussed in section [2 Note that the function ([6?]) cannot be 
of the form f m . Indeed the function values of the former are 2g-th roots of unity, whereas 
the function values of the latter are g-th roots of unity. 

Applying (f65|) and (|67|) to any single cyclic subgroup of a general Abelian group G and 
and applying (|66p to any pair of cyclic subgroups yield quadratic functions of G. Finally 
we remark that the set of a quadratic functions of G can be shown to be a group under 
the multiplication of functions; the neutral element is the trivial function g — > 1 and the 
inverse of £ is its complex conjugate. Thus further examples of quadratic functions (and 
the associated quadratic phase gates) can be obtained by taking products and complex 
conjugates, and combinations thereof, of the examples given above. 
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A Efficient quantum circuits 

We show that every automorphism gate and quadratic phase gate can be realized as an 
efficient quantum circuit. 

Let a be an automorphism of G, specified in terms of its matrix representation. Recall 
that the function a is invertible and that a(g) is efficiently computable on input of g (cf. 
section [6]) . Thus there exists an efficient circuit of classical reversible gates that computes 
g —> a(g). But then the standard translation of these classical gates into unitary operators 
yield an efficient quantum circuit to compute \g) — > \a(g)). 

Let £ be a quadratic function, specified in terms of its standard representation as in 
section [2j Recall from section [6] that g — > £(g) can be computed efficiently classically. 
Furthermore each is a 2g-th root of unity. Writing = exp[iirn(g) / g] where n(g) is 
an integer between and 2g, we denote by f(g) the bit string corresponding to the binary 
expansion of n(g). Note that each f(g) has length k = O(logg) and that g — > f(g) can be 
computed efficiently classically. We will write f(g) = fi(g) • • • fk(g) where each fi(g) is a 
bit; the relation to n(g) is given by n(g) = Ylj=i /iCff)^ -1 - It follows that 

£(<?)= w:=expK2^V0]. (68) 

Now consider the following procedure: start with the input |<7)|0) where |0) represents a 
string of k ancillary qubits in the state |0). Since f(g) can be computed efficiently classically, 
there exist a efficient quantum circuit realizing Uf : \g)\a) — > \g)\f(g) + a) for every fc-bit 
string a (where f(g) + a is computed modulo 2) so that in particular \g)\0) is mapped to 



23 



\g)\f(g))- We now apply the single-qubit gate diag(l, ujj) to qubit j in the second register, 
for all j. Using (|68p this maps 

\9)\M)^t(9)\9)\f(9))- (69) 

Finally, applying the inverse of Uf maps £(g)\g)\f{g)) £{g)\g)\ty- This yields the desired 
efficient circuit that realizes Ug. 

B Proof of theorem [3] 
B.l Proof of theorem [3h 

Let h 1 ,. . . ,h n represent a generating set of H. The orthogonal subgroup H 1 - consists of all 
g £ G satisfying = 1 f° r au Let U(l) denote the (multiplicative) Abelian group of 

all complex phases, where 1 is the neutral element. Let U(l) n be the group of all n-tuples 
of complex phases where the group operation is componentwise multiplication; the neutral 
element is (1, . . . , 1). For every g 6 G we extend the domain of the function Xg to the set of 
all m-tuples of integers i.e. if k = k\ ■ ■ ■ k m G Z m with ki integer, one has 

Xg :k -> exp2vri(^ + ... + ^), (70) 

where, with a slight abuse of notation, we denote the function (|70p by Xg as well. We now 
introduce the following maps. 

i]:G-> U(l) n maps g -)• (x^i(ff), • • ■ ,Xfc«(s)) 

V? : Z m -> £7(1)" maps k -)• ( X ^(fc), . . . , (*:))■ 

7r : Z m —7- G maps fc — )■ (fci mod d\, . . . , k m mod d m ). 

Remark that it is the natural "projection" of Z m onto G. Every g £ G can naturally be 
interpreted as an m-tuple of integers; we denote this tuple by g if we want to emphasize this 
way of interpreting g. Note that ir(g) = g. 

Lemma 13. The maps rj,(p and ir are group homomorphisms. Furthermore <p = 77 • 7T. 
Finally, H 1 - coincides with the kernel ofrj. 

Proof: all properties can be verified by a straightforward application of definitions, except 
the identity ip = rj ■ tt which we address next. Let k = k% - •■ k m be any m-tuple of integers 
and denote ir(k) = l±- ■ -l m with /j G Z^. Then (by the definition of x mod y) there exist 
integers Cj such that ki = l{ + Q<ij. Insertion in ([TO]) shows that Xg(k) = Xgi^i^)) f° r every 
g e G. It follows that ^(fe) = rj(7r(k)). □ 

To prove theorem [3] our goal is to compute a generating set of the kernel of rj. Our 
approach will be to first compute a generating set of the kernel of <p, and then to map this 
solution to a generating set of ker 77 via the projection it. Remark that k £ ker <p iff 

aii&i H h a im k m = mod g; where Ojj := ghj/dj. (71) 

Remark that d, divides q so that the au are integers. Equivalent to ()7ip . there exists a 
tuple of integers s = si . . . s n such that J2 a ij^j + s i = 0- This is a system of linear 
diophantine equations in the unknowns (k, s). Owing to theorem H] we can find a generating 
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set of solutions (/c 1 ,,? 1 ), . . . (k r ,s r ) in polylog(g) time. It then follows that the k? form a 
generating of solutions to the equations (|7ip and thus are a generating set of ker (p. 

Define g l := %{k l ) for every i. Note that each g l can be computed efficiently since this 
computation involves taking m remainders. We now claim that the g % generate ker n. First, 
we have g % G ker rj: indeed by construction k % G ker ip and owing to lemma [13] we have 
ip = rj ■ 7r, implying that n(k l ) G ker rj. Second, we show that every element in the kernel 
of rj can be written as an integer linear combination of the g % . Consider an arbitrary g G 
ker rj. Interpreting g as an element in Z m we thus have g G ker ip. Since the k % generate 
ker (p, there exist integers Cj such that g = ^Cik 1 . Since tt is a homomorphism, it follows 
that ir(g) = ^Cj7r(A; 1 ). Using that ir(g) = g and g % = ix{k % ) we conclude that g = Yl°i9 l as 
desired. This proves theorem [3h. 

B.2 Proof of theorem [3j3 

The proof method is analogous to above (although the argument is simpler since we do not 
need to compute a generating set of solutions but merely a single solution) and we just give 
a sketch. Using the notations introduced above, our goal is to compute a g G G satisfying 

v (g) = ( e 27risi/s , e 2nis "/ 9 ) =: v. (72) 

Analogous to above (see ([TT]) ) we can write down a system of diophantine equations which 
has a solution iff there exists k G Z m satisfying ip(k) = v. Deciding whether a solution 
exists can be done efficiently by virtue of theorem [H If a solution exists, owing to the same 
theorem such a solution k can be computed efficiently. We then compute g := ir(k) which 
can also be done efficiently. Since (p = rj ■ it it follows that rj(g) = v as desired. 

B.3 Proof of theorem [3h 

Lemma 14. Let a be an automorphism of G with matrix representation A. Then there 
exists a unique matrix B where each element in the i-th row of B belongs to Z^- and such 
that the following identities hold: 

djBij = mod for every i,j (73) 

in 

BijAji = 1 mod di for every i (74) 

i=i 
fit 

BijAji = mod dk for every k ^ i. (75) 

i=i 

Furthermore this unique solution B is the matrix representation of aT 1 . 

Proof: to show existence, it is straightforward to verify (with lemma [3]) the matrix 
representation of a -1 satisfies ([73]) - ([75]) . To prove uniqueness, ([73]) and lemma [3] imply that 
there exists an endomorphism f3 of G with matrix representation B. Conditions (j74h - (l75p 
imply that (3a(e l ) = e l for every i. Since a and (3 are endomorphisms, it follows that 
f3a(g) = g for every g G G. But then f3 must be identical to the inverse of a, which always 
exists and which is unique. But then also B is unique. □ 

Our proof of theorem [St now proceeds as follows. For every m x m integer matrix X, 
let II(X) denote the matrix obtained by replacing the entry X%j by Xij mod di. We now 
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first compute an integer matrix B satisfying (|73p - (|75p . thus for the moment ignoring the 
constraint that the i-th row of B should only contain elements of Z^. Computing such 
an integer matrix solution can be done efficiently by reducing the problem to a system of 
diophantine equations (by introducing extra integers variables as before). Given an integer 
solution B, we compute B' := U(B); this can be done efficiently. Remark that every element 
in the i-th row of B' does belong to Z^. . We now claim that B' is still a solution to (|73p-(|75p. 
By definition of the map II, for every there exists an integer CV,- which is an integer 
multiple of di, such that BL = By +C{j. Since each Cy is an integer multiple of di, one has 

djCij = mod di for every i,j 

m 

CkjAji = mod dk for every k. (76) 

i=i 

Using (|76p in combination with the property that B solves (|73 p - (|75p . it follows that B' is a 
solution to these equations as well. Thus B' is the matrix representation of a -1 . 



C Proof of theorem [6] 

The normalized sum p := (1/|£7|)^][^ over all [/ £ £7 is the orthogonal projector on the 
space of all +1 common eigensvectors of Q (this property holds for arbitrary unitary groups, 
see e.g. [24] ) . Since is the unique joint eigenvector with eigenvalue 1 by assumption, we 
thus have p = Consider an arbitrary g such that (g\ip) ^ 0. Then 

M°cM<#7> = p£W- (77) 

This shows that all amplitudes (h\if>) are zero whenever h lies outside the orbit O g . Now 
consider an arbitrary h G O g . Then, by definition of O g , there exist U G Q satisfying 
U\g) = d g \h) where d g is the diagonal entry of D on position g. Remark that d g is a 
complex phase since U is unitary. Using that = it follows that (h\tp) = d g (g\ip). 

This proves that all amplitudes (h\ip) with h G O g are equal in modulus. This shows (a) 
and (b). 

Next we prove (c). Suppose first that O g = S and consider a generator V{. Then there 
exists a complex phase £ such that V{\g) = £\g). It follows that 

(m\g) = mg)- (78) 

Using that {ij)\V% = (ip\ since Vi belongs to Q, one finds that (ip\g) = £{ip\g)- Since O g = S 
and g G O g , it follows that (ip\g) / 0. With (175]) this shows that £ = 1. Conversely, suppose 
that g satisfies Vi\g) = \g) for every i. As a consequence, V\g) = \g) for every V G Q g . Using 
that p = yields 

k^>i 2 = iEw4Ew = l^' (79) 

11 u&g u&g a 

In the second identity we have used that (g\U\g) = if U ^ Q x since U is monomial; in the 
third identity we used that U\g) = \g) for every U G Q x . Finally we used that \Q g \ ^ since 

ieg g . 
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D The quadratic functions (1671) 



We prove that the function (|67j) . denoted here by £, is quadratic. Consider x, y € Z^. Within 
the present section, we denote by x + y the sum of these elements over the integers, whereas 
x © y denotes the sum in Z^. With this notation, one has 

x © y = 1 + 1/ mod d and q a {x) = ax{x + d) (80) 

It follows from the left-hand equation in ()80|) that there exists an integer 6 such that x © y = 
x + y A-bd. Consequently, 

q a {x@y) = q a (x + y + qd) = q a (x) + q a (y) + 2axy + ac (81) 
where c := 2xbd + 2ybd + d 2 b{b + 1). (82) 

Remark that c is an integer multiple of 2d. Indeed, both terms 2xbd and 2ybd are obviously 
multiples of 2d; furthermore 6(6 + 1) is even for every integer 6, so that d 2 b(b + 1) is also a 
multiple of 2d. It follows that exp[iirac/d] = 1 and thus with (|81|) one finds 

£(x © y) = e i Ala{x)+q a (y)+2axy+ac\/ d 

= jnq a (x)/d e iriq a (y)/d e 27riaxy/d e 7riac/d = £( X )£(y)B(x,y), (83) 

with B(x,y) := exp[2maxy/d]. Since the function B is bilinear, this shows that £ is 
quadratic. 
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